Mailpit’s dump --http sub‑command downloads messages from a remote Mailpit instance and writes them as <id>.eml into a user‑supplied output directory. The message ID, taken directly from the server’s JSON response, is appended to the output path using path.Join, which silently normalizes '..' segments. A malicious HTTP server impersonating Mailpit can, therefore, cause the dump operation to write attacker‑controlled bytes to any location writable by the running user, fully outside the intended directory. This results in arbitrary file write and potentially overwriting system files or delivering malicious payloads. The issue is a combination of path‑traversal (CWE‑22) and unrestricted file write (CWE‑829).

All installations of Axllent Mailpit prior to version 1.30.0 are affected, regardless of operating system or environment. The vulnerability is triggered when the dump --http command is used against a remote Mailpit instance that the attacker controls or mimics.

The CVSS score of 5.9 indicates medium severity, and the EPSS score of < 1% suggests a low likelihood of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog. An attacker would need to host a malicious HTTP endpoint that masquerades as a Mailpit instance; the victim must then run the dump --http command against it.